cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

CVE-2026-19729 Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2026-19729

CVE-2026-19729 is an incomplete fix for CVE-2026-9083 in the key provider component of the keycloak-services library (core engine of the Red Hat Build of Keycloak). A relative path traversal remains, allowing a realm administrator to submit arbitrary filesystem paths as keystore parameters and de...

EUVD-2026-74756

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2026-19729

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2025-6019

CVE-2025-6019 Proof of Concept PoC This repository contains a Proof of Concept PoC script for CVE-2025-6019 , a Local Privilege Escalation LPE vulnerability in libblockdev and udisks. The script creates an XFS filesystem image with an SUID bash binary and exploits the vulnerability to mount it...

CVE-2024-21626-POC

CVE-2024-21626-POC Usage Instructions For educational/research purposes only. Any behavior not related to education/research is at your own risk. Usage root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh Start another terminal /bin/bash.copy Note...

sandbox-runtime

Anthropic Sandbox Runtime srt Una herramienta ligera de sandboxing para imponer restricciones de sistema de archivos y red en procesos arbitrarios a nivel del sistema operativo, sin necesidad de un contenedor. srt utiliza primitivas nativas de sandboxing del SO sandbox-exec en macOS, bubblewrap e...

CVE-2021-41091

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host. Vulnerability Summary CVE-2021-41091 is a flaw in Moby Docker Engine that allows...

CVE-2023-0386

Compilación root@kitploit: make all Uso Abra dos terminales, en la primera terminal ingrese root@kitploit: ./fuse ./ovlcap/lower ./gc En la segunda terminal ingrese root@kitploit: ./exp Efecto Efecto de escalada de privilegios Mostrar efecto...

CVE-2022-1011

CVE-2022-1011 Fix link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=0c4bcfdecb1ac0967619ee7ff44871d93c08c909 This vulnerability is mainly due to the asynchronous nature of splice, which allows the user-mode filesystem process server side to retain a piece of memor...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow is a platform for business transformation which helps companies manage digital workflows for enterprise operations. CVE-2024-4879 could allow an unauthenticated user to remotely execute code within the Now Platform. This vulnerability exploits three issues by...

CVE-2026-87505

A flaw was found in the FileSystem component of Chromium. A remote attacker, who has already compromised the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted PDF file. This could allow the attacker to bypass site isolation, potentially leading ...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW A POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory. See cve-2024-32002-submodule-aw for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines th...

CVE-2026-87493

A flaw was found in chromium-browser. Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

CVE-2026-87603

A flaw was found in Google Chrome's FileSystem component. A remote attacker could exploit this missing authorization vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, potentially leading to unauthorize...

CVE-2026-87547

A flaw was found in Google Chrome's FileSystem component. This vulnerability, caused by incorrect reference resolution, could allow a remote attacker to leverage social engineering tactics. By enticing a user to visit a specially crafted HTML page, the attacker could potentially execute arbitrary...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation and POC This repository contains a Proof of Concept POC for CVE-2024-50379 , a vulnerability affecting Apache Tomcat. The issue involves a Time-of-Check Time-of-Use TOCTOU race condition , which can lead to Remote Code Execution RCE , especially on case-insensitive fil...

CVE-2026-87487

A flaw was found in the FileSystem component of Chromium. This missing authorization vulnerability could allow a remote attacker, who has already compromised the renderer process and leveraged social engineering, to potentially execute arbitrary code outside of the sandbox. This exploitation is...

CVE-2026-87611

A flaw was found in Google Chrome. Missing authorization in the FileSystem component allows a remote attacker, who has already compromised the renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML page...